Privacy Policy

In this Privacy Policy, the following terms have the meanings assigned to them below:

• "satu38" / "we" / "us" / "our" — the online betting and casino platform operating at satu38.cam, including all associated subdomains and services.
• "User" / "you" / "your" — any individual who accesses, browses, or registers an account on the satu38 Platform.
• "Personal Data" — any information relating to an identified or identifiable natural person, including name, contact details, financial information, and device identifiers.
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• "Controller" — satu38, as the entity that determines the purposes and means of processing your Personal Data.
• "Processor" — a third party that processes Personal Data on behalf of satu38, such as payment gateway providers or cloud hosting vendors.
• "KYC" — Know Your Customer; the identity and age verification process conducted by satu38 to confirm a User's identity and eligibility.
• "Cookies" — small data files stored on your device by the Platform to enable session management, preference retention, and analytics.
• "IDR" — Indonesian Rupiah, the currency in which all satu38 transactions are denominated.

satu38 collects the following categories of Personal Data from Users:

satu38 collects Personal Data through the following channels:

• Direct submission — when you complete the registration form, submit KYC documents, request a withdrawal, contact support, or respond to a survey.
• Automated collection — when you browse the Platform, our servers automatically record Technical Data and Usage Data via server logs, cookies, and similar tracking technologies.
• Payment processors — when you make a deposit or withdrawal, the relevant bank or e-wallet provider (BCA, BRI, OVO, DANA, GoPay, etc.) transmits transaction confirmation data to satu38 for payment reconciliation.
• Third-party game providers — when you play a game provided by a licensed third-party studio (e.g., Pragmatic Play, Evolution Gaming, Microgaming), that provider may share session-level data with satu38 for dispute resolution and audit purposes.
• Identity verification services — where satu38 uses a third-party KYC verification vendor, that vendor may cross-reference identity documents with authoritative databases and return a verification result to satu38.

satu38 processes your Personal Data for the following purposes:

• Account administration — creating and managing your account, processing login authentication, maintaining account security settings, and operating two-factor authentication.
• Payment processing — executing deposits and withdrawals in IDR through Indonesian banks and e-wallets, reconciling transactions, and investigating payment disputes.
• KYC and compliance — verifying your age (21+) and identity, meeting anti-money-laundering obligations, and maintaining the regulatory audit trail required by applicable international standards.
• Responsible gaming — monitoring wagering patterns for signs of problem gambling, applying self-imposed limits and self-exclusion requests, and contacting Users who exhibit high-risk indicators.
• Customer support — responding to queries, resolving disputes, and maintaining communication records in the event of an escalation or regulatory inquiry.
• Platform security and fraud prevention — detecting and preventing unauthorised access, duplicate accounts, bonus abuse, collusion, automated betting, and other prohibited activities.
• Service improvement and personalisation — analysing usage patterns to enhance platform performance, game selection, and user experience for Indonesian players.
• Marketing communications — sending promotional offers, bonus announcements, and seasonal promotions (such as Idul Fitri or Indonesian Independence Day specials) to users who have opted in to marketing communications. You may withdraw this consent at any time by contacting support or updating your account preferences.

satu38 processes your Personal Data on one or more of the following legal bases:

• Contractual necessity — processing required to perform the contract between you and satu38, including account registration, payment processing, and bet settlement.
• Legal obligation — processing necessary to comply with applicable anti-money-laundering rules, age-verification requirements, and international regulatory standards to which satu38 is subject as a licensed operator.
• Legitimate interests — processing carried out for satu38's legitimate operational interests, such as fraud prevention, platform security, abuse detection, and service improvement, where those interests are not overridden by your rights and freedoms.
• Consent — processing based on your freely given, specific, and informed consent, particularly for optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

satu38 does not sell or rent your Personal Data. We may share your data with the following categories of recipients, strictly on a need-to-know basis and under appropriate contractual safeguards:

• Payment processors and banks — BCA, BRI, BNI, Mandiri, CIMB Niaga, OCBC NISP, and e-wallet providers (OVO, DANA, GoPay, ShopeePay, LinkAja) receive the minimum transaction data required to process your deposits and withdrawals.
• KYC and identity verification vendors — authorised third-party providers who verify identity documents against official records and return a pass/fail result to satu38. These vendors are contractually prohibited from using your data for any other purpose.
• Game content providers — licensed studios such as Pragmatic Play, Evolution Gaming, Microgaming, NetEnt, and Spribe receive session identifiers and stake data necessary to operate their games within the Platform. They do not receive your full identity profile.
• Cloud infrastructure and hosting providers — satu38 uses reputable cloud providers to host and operate the Platform. These vendors act as data Processors under binding data-processing agreements and may not process your data for their own purposes.
• Fraud prevention and cybersecurity services — specialist vendors who assist satu38 in identifying suspicious patterns, detecting bot activity, and preventing account compromise.
• Legal and regulatory authorities — where required by law or a valid court or regulatory order, satu38 may disclose Personal Data to law enforcement, financial intelligence units, or other competent authorities. satu38 will only disclose the minimum data required and will notify you where legally permitted to do so.
• Professional advisors — lawyers, auditors, and accountants who are bound by professional confidentiality obligations and who provide services to satu38 in connection with its legal, financial, or compliance obligations.

satu38 uses cookies and similar technologies to provide a functional, secure, and personalised experience on the Platform. The following categories of cookies are in use:

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from using core Platform features including login and payment processing. Analytical and functional cookies may be disabled without affecting your ability to place bets or make transactions.

satu38 retains Personal Data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention schedule applies:

• Account and identity data — retained for the duration of your account plus 5 years after account closure, in line with international anti-money-laundering standards.
• Transaction and financial records — retained for a minimum of 5 years from the date of each transaction, regardless of account status.
• KYC documents — retained for 5 years after the completion of the KYC process or account closure, whichever is later.
• Customer support communications — retained for 3 years from the date of each interaction, or longer if the communication relates to an open dispute or regulatory inquiry.
• Marketing consent records — retained for the duration of your consent plus 3 years after withdrawal of consent, as evidence of lawful processing.
• Technical and usage data (anonymised) — anonymised analytics data may be retained indefinitely, as it no longer constitutes Personal Data once de-identified.

Upon expiry of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised. Where a legal hold is in place (e.g., due to pending litigation or a regulatory request), retention is extended until the hold is lifted.

satu38 implements a layered security architecture to protect your Personal Data against unauthorised access, loss, alteration, or disclosure. Key measures include:

• 256-bit SSL/TLS encryption on all data transmissions between client devices and satu38 servers.
• AES-256 encryption at rest for all stored Personal Data, including identity records and financial information.
• One-way password hashing using a modern adaptive algorithm — passwords are never stored or transmitted in plain text.
• Two-factor authentication (2FA) available to all registered Users, strongly recommended for accounts with significant wallet balances.
• Access controls and role-based permissions — internal staff access to Personal Data is restricted to those with a demonstrable operational need, and all access is logged and audited.
• Regular penetration testing and vulnerability assessments conducted by independent third-party security specialists.
• Intrusion detection systems monitoring for anomalous access patterns, brute-force attempts, and data exfiltration signals in real time.
• Data breach response plan — in the event of a confirmed data breach affecting your Personal Data, satu38 will notify affected Users without undue delay and take immediate remedial action.

While satu38 takes all reasonable precautions, no data transmission over the internet can be guaranteed to be entirely secure. You are responsible for keeping your account credentials confidential and for logging out of shared devices after each session.

As a satu38 User, you hold the following rights with respect to your Personal Data. To exercise any of these rights, submit a written request to [email protected]. satu38 will respond within 30 calendar days.

Where your request is denied, satu38 will provide a written explanation of the grounds for refusal and inform you of your right to escalate the matter.

satu38 is strictly an adults-only platform. Access to the Platform is prohibited for any person under the age of 21 years. satu38 does not knowingly collect Personal Data from individuals under 21. If we become aware that Personal Data has been collected from a minor, we will immediately close the associated account, delete the data, and — where applicable — forfeit any wallet balance in accordance with our Terms & Conditions.

If you believe that a minor has registered an account on satu38 using false information, please notify us immediately at [email protected]. We take such reports seriously and will investigate them as a priority matter.

satu38 operates on infrastructure that may involve the transfer of Personal Data to servers or processors located outside Indonesia. Where such transfers occur, satu38 takes all reasonable steps to ensure that your data receives an equivalent level of protection to that afforded within Indonesia, including:

• Entering into data-processing agreements with all third-party Processors that include binding data-protection obligations.
• Using only reputable cloud infrastructure providers with internationally recognised security certifications (e.g., ISO 27001, SOC 2 Type II).
• Applying encryption and pseudonymisation measures during cross-border data flows to minimise exposure risk.

By using satu38 and accepting this Privacy Policy, you acknowledge that your Personal Data may be transferred to and processed in jurisdictions outside Indonesia, under the safeguards described above.

satu38 may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or the way the Platform operates. Material changes will be communicated to you by a notice on the Platform and, where significant, by email to your registered address.

The "Last Updated" date at the top of this page identifies the date of the most recent revision. We encourage you to review this page periodically. Your continued use of the Platform after the effective date of any amendment constitutes your acceptance of the revised Privacy Policy. If you do not agree with an amendment, you should discontinue use of the Platform and request account closure.

For all privacy-related enquiries, data-rights requests, or complaints, please contact satu38's privacy team using the details below. We aim to acknowledge all requests within 5 business days and resolve them within 30 calendar days.

If you are not satisfied with satu38's response to your privacy complaint, you have the right to escalate the matter to the relevant supervisory or regulatory authority in your jurisdiction. satu38 will cooperate fully with any such authority in the course of its investigation.

For questions specifically related to responsible gaming, account self-exclusion, or deposit limits, please refer to the Responsible Gaming page, which contains dedicated guidance and contact channels.